What is the CVSS score of CVE-2026-55248?

CVE-2026-55248 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of plone.app.portlets are affected by CVE-2026-55248?

Plone's RSS feed portlet component (plone.app.portlets) is affected by a critical denial-of-service vulnerability (CVE-2026-55248, CVSS 9.1) disclosed today that allows attackers to exhaust server…. A patch is available.

How to fix or mitigate CVE-2026-55248?

Within 24 hours: Document all Plone instances in production, identify current versions, and disable untrusted RSS portlet sources where operationally feasible. Within 7 days: Implement network-level rate limiting and request inspection on affected Plone deployments; establish alerting for abnormal resource consumption. Within 30 days: Apply vendor-released patch immediately upon availability; validate remediation across all production Plone instances.

plone.app.portlets CVE-2026-55248

EUVD-2026-67864 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-06-23

GHSA-x5g3-w747-2h8q

Denial Of Service

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

vuln.today AI

7.7 HIGH

Network-reachable RSS fetch trigger; PR:L assumed as portlet URL configuration likely requires authenticated access; S:C reflects server-wide availability collapse from resource exhaustion.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Aug 28, 2026 - 21:17 EUVD

CVSS changed

Aug 28, 2026 - 20:22 NVD

9.1 (CRITICAL)

Analysis Generated

Jun 23, 2026 - 20:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Plone's RSS feed portlet component (plone.app.portlets) allows an attacker to exhaust server resources by supplying or triggering the parsing of a maliciously crafted RSS/Atom feed, rendering the Plone application unavailable. Disclosed June 23, 2026 as part of a coordinated Plone security release, the issue carries a critical severity rating of 9.1. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in plone.app.portlets, the Plone CMS package that implements pluggable UI portlets including an RSS/Atom feed reader. RSS portlets fetch external syndication feed URLs and parse their XML content for rendering within Plone pages. A denial-of-service condition arising from feed parsing is typically rooted in uncontrolled resource consumption during XML processing - common patterns include deeply nested element trees, billion-laughs-style entity expansion, or pathologically large field values that exhaust CPU or heap memory during deserialization. No CWE was assigned in the available data, but the vulnerability class is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-776 (Improper Restriction of Recursive Entity References in DTDs). No CPE strings were provided; the authoritative vendor advisory is GHSA-x5g3-w747-2h8q at https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q.

RemediationAI

Apply the updated plone.app.portlets package released in conjunction with the June 23, 2026 coordinated security advisory. The exact patched version number is not available in the current dataset and must be obtained from the vendor advisory at https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q or the PyPI release page for plone.app.portlets. As a compensating control pending patching, administrators should consider removing RSS feed portlets from all public-facing Plone pages, which eliminates the attack surface entirely but removes feed aggregation functionality. Restricting portlet configuration permissions to site administrators only limits who can point the portlet at attacker-controlled URLs, but does not prevent the DoS if the portlet is already configured to fetch from an external source. Network-level egress filtering to block or proxy outbound RSS fetch requests from the Plone application server can also reduce exposure while a patch is applied.